🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 9


Intelligence 9 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf
SHA3-384 hash: cd01d662676c81bee19f0e71dc446df48c0342e0675dce568179277776dd2b95f616b1dde8c8ef46681a5be539115060
SHA1 hash: f9365c7876ac8934a48237499cf8774fe78ea196
MD5 hash: 64a6cf00b80fe77c16f6da137dd7a9d1
humanhash: illinois-bulldog-crazy-glucose
File name:740d3a.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:6'722'560 bytes
First seen:2024-11-20 10:14:25 UTC
Last seen:2024-11-20 10:26:36 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:E0hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhV:E8eHZC6kP
Threatray 36 similar samples on MalwareBazaar
TLSH T1D366D02176CBC03AE16D06725679EB6E503FBD220B3154C7A3E4796D9D307C12A3AA4F
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter JAMESWT_WT
Tags:167-114-47-186 api-ewfiles-net AsyncRAT DarkGate FUJI FURUKAWA E C VIETNAM CO LTD msi purecrypter signed

Code Signing Certificate

Organisation:FUJI FURUKAWA E&C (VIETNAM) CO.,LTD
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2024-10-09T05:00:25Z
Valid to:2025-10-10T05:00:25Z
Serial number: 6447de04acbf7f648e82d18d
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: b376a291e7221003d89c03ce2c9aae0cd49a2405386fc2b311ce7c62e3406eca
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoad4.16298.18686.14967.UNOFFICIAL
Create hunting rule

MiscreantPunch.SingleXOR.EXE.203.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673db759ebd8decee51f521e
Tags:
shellcode dropper virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd fingerprint lolbin msiexec obfuscated packed remote runonce wix
Link:
https://www.filescan.io/uploads/673db6aeb13627e974ad1838/reports/10f4af64-6bf1-4842-b375-73cfcd89bf2d/overview
Verdict:
Suspicious
Labled as:
ABRisk.WYKQ
Link:
https://www.hybrid-analysis.com/sample/630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf
Result
Threat name:
PureCrypter
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1559267
Signature
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Creates autostart registry keys with suspicious names
Detected PureCrypter Trojan
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1559267 Sample: 740d3a.msi Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 140 Suricata IDS alerts for network traffic 2->140 142 Multi AV Scanner detection for dropped file 2->142 144 Multi AV Scanner detection for submitted file 2->144 146 3 other signatures 2->146 14 msiexec.exe 86 55 2->14         started        17 AutoIt3.exe 2->17         started        19 AutoIt3.exe 2->19         started        21 msiexec.exe 2 2->21         started        process3 file4 128 C:\Windows\Installer\MSIE90C.tmp, PE32 14->128 dropped 130 C:\Windows\Installer\MSIE774.tmp, PE32 14->130 dropped 132 C:\Windows\Installer\MSIE735.tmp, PE32 14->132 dropped 134 4 other malicious files 14->134 dropped 23 aipackagechainer.exe 1 3 14->23         started        26 msiexec.exe 33 14->26         started        28 MSBuild.exe 17->28         started        30 MSBuild.exe 19->30         started        process5 file6 110 C:\Users\user\AppData\Local\...\AI_F78C.ps1, ASCII 23->110 dropped 32 Vista Software.exe 2 23->32         started        35 powershell.exe 2 21 23->35         started        112 C:\Users\user\...\aipackagechainer.exe, PE32 26->112 dropped 114 C:\Users\user\AppData\...\Vista Software.exe, PE32 26->114 dropped 116 C:\Users\user\AppData\...\file_deleter.ps1, ASCII 26->116 dropped process7 file8 104 C:\Users\user\AppData\...\Vista Software.tmp, PE32 32->104 dropped 38 Vista Software.tmp 3 4 32->38         started        41 conhost.exe 32->41         started        43 tasklist.exe 32->43         started        45 find.exe 32->45         started        148 Found many strings related to Crypto-Wallets (likely being stolen) 35->148 47 powershell.exe 11 35->47         started        49 powershell.exe 35->49         started        51 conhost.exe 35->51         started        signatures9 process10 file11 108 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 38->108 dropped 53 Vista Software.exe 2 38->53         started        56 conhost.exe 47->56         started        58 conhost.exe 49->58         started        process12 file13 106 C:\Users\user\AppData\...\Vista Software.tmp, PE32 53->106 dropped 60 Vista Software.tmp 18 9 53->60         started        process14 file15 120 C:\Users\user\AppData\...\file.exe (copy), PE32 60->120 dropped 122 C:\Users\user\AppData\...\unins000.exe (copy), PE32 60->122 dropped 124 C:\Users\user\AppData\Local\...\is-AA44E.tmp, PE32 60->124 dropped 126 2 other files (none is malicious) 60->126 dropped 63 file.exe 60->63         started        66 cmd.exe 60->66         started        68 cmd.exe 60->68         started        70 4 other processes 60->70 process16 signatures17 164 Found many strings related to Crypto-Wallets (likely being stolen) 63->164 72 cmd.exe 63->72         started        75 conhost.exe 66->75         started        77 tasklist.exe 66->77         started        79 find.exe 66->79         started        81 conhost.exe 68->81         started        83 tasklist.exe 68->83         started        85 find.exe 68->85         started        87 conhost.exe 70->87         started        89 8 other processes 70->89 process18 signatures19 158 Uses ping.exe to sleep 72->158 160 Uses ping.exe to check the status of other devices and networks 72->160 91 file.exe 72->91         started        95 PING.EXE 72->95         started        98 conhost.exe 72->98         started        process20 dnsIp21 118 C:\dbgbkfc\AutoIt3.exe, PE32 91->118 dropped 162 Creates autostart registry keys with suspicious names 91->162 100 MSBuild.exe 91->100         started        138 127.0.0.1 unknown unknown 95->138 file22 signatures23 process24 dnsIp25 136 167.114.47.186, 49984, 56001 OVHFR Canada 100->136 150 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 100->150 152 Found many strings related to Crypto-Wallets (likely being stolen) 100->152 154 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 100->154 156 4 other signatures 100->156 signatures26
Score:
84%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmfm57qtn2rojo4veencctsifhmmwwou3felberb4ynm2j4iks7q._file
Verdict:
malicious
Label(s):
darkgate
Create hunting rule
Similar samples:
46604751c20aebeac273f00f5614a5b6ac72e26a9486e006fb37dd90cf22f6b8
DarkGate
5659f401e9c479d51bf256092e8d7b0c00abc6286e7f3b2d7f527995a145593d
DarkGate
62bd169a33d75b7f682c786a8639cc867d4be43628def65757c31c1efd5c4905
DarkGate
bb870923c6ac61383177d3bb41726ea290a29a4a762fd681dec3d4f6cc19ed93
DarkGate
e11dc8d2e7fba91857df6a38c6e64ad491a9271b9f0bfda937680dd0da453665
DarkGate
e61ce90df13402909985f5312fdef798736eb10e0b5b6b280fb826538e7a597a
DarkGate
error
DarkGate
+ 26 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/241120-l98snsvekf/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Checks installed software on the system
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Enumerates processes with tasklist
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Blocklisted process makes network request
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d456afa1-c051-4ff0-8269-6a9dd3eb6fd9
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Script
Create hunting rule
Author:@bartblaze
Description:Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkGate

Microsoft Software Installer (MSI) msi 630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3297073/
  
Delivery method
Distributed via web download

Comments